polkowice.pl
poltava.ua
polyspace.com
pomorskie.pl
pomorze.pl
poniatowa.pl
ponpes.id
pordenone.it
porn
porsanger.no
porsangu.no
porsgrunn.no
porsáŋgu.no
port.fr
post
post.in
postman-echo.com
potager.org
potenza.it
powiat.pl
poznan.pl
pp.az
pp.ru
pp.se
pp.ua
ppg.br
pr
pr.gov.br
pr.gov.pl
pr.it
pr.leg.br
pr.us

- Fix handling of aws-load-balancer-security-groups annotation. Security-Groups assigned with this annotation are no longer modified by kubernetes which is the expected behaviour of most users. Also no unnecessary Security-Groups are created anymore if this annotation is used. ([#88691](https://github.com/kubernetes/kubernetes/pull/88691), [@Elias481](https://github.com/Elias481)) [SIG Cloud Provider]

   * are guarded by a lock and operations are applied in batches to avoid lock contention. The
   * penalty of applying the batches is spread across threads so that the amortized cost is slightly
   * higher than performing just the operation without enforcing the capacity constraint.
   *
   * This implementation uses a per-segment queue to record a memento of the additions, removals,

* CRI now defines mounting behavior. If the host path doesn't exist, the runtime should return an error. If the host path is a symlink, the runtime should follow the symlink and mount the real destination to the container. ([#61460](https://github.com/kubernetes/kubernetes/pull/61460), [@feiskyer](https://github.com/feiskyer))

- Fix handling of aws-load-balancer-security-groups annotation. Security-Groups assigned with this annotation are no longer modified by kubernetes which is the expected behaviour of most users. Also no unnecessary Security-Groups are created anymore if this annotation is used. ([#88690](https://github.com/kubernetes/kubernetes/pull/88690), [@Elias481](https://github.com/Elias481)) [SIG Cloud Provider]

				"application/javascript",
				"application/json",
				"application/java-vm",
				"application/x-java-jnilib",
				"application/kpml-request+xml",
				"application/kpml-response+xml",
				"application/lost+xml",
				"application/mac-binhex40",
				"application/mac-compactpro",
				"application/macwriteii",
				"application/marc",
				"application/mathematica",
				"application/mathml+xml",

## Changelog since v1.26.8

## Changes by Kind

### API Change

- Fixed a bug where CEL expressions in CRD validation rules would incorrectly compute a high estimated cost for functions that return strings, lists or maps.

  - The `ValidateProxyRedirects` feature was promoted to Beta and enabled by default. This feature restricts redirect-following from the apiserver to same-host redirects.  If nodes are configured to respond to CRI streaming requests on a different host interface than what the apiserver makes requests on (only the case if not using the built-in dockershim & setting the kubelet flag `--redirect-container-streaming=true`), then these requests will be broken....

### Other notable changes

* [GCE] Apiserver uses `InternalIP` as the most preferred kubelet address type by default. ([#59019](https://github.com/kubernetes/kubernetes/pull/59019), [@MrHohn](https://github.com/MrHohn))

  - [Changelog since v1.19.14](#changelog-since-v11914)
  - [Important Security Information](#important-security-information)
    - [CVE-2021-25741: Symlink Exchange Can Allow Host Filesystem Access](#cve-2021-25741-symlink-exchange-can-allow-host-filesystem-access)
  - [Changes by Kind](#changes-by-kind-1)
    - [Bug or Regression](#bug-or-regression-1)
    - [Other (Cleanup or Flake)](#other-cleanup-or-flake)